Banklink: users of Yodlee-backed services operate in “grey area”

Users of accounting services backed by US financial data aggregator Yodlee were in a “grey area” in determining liability if they fell victim to fraud, New Zealand competitor BankLink has claimed.

Yodlee’s services were used by cloud accounting programs Xero and Saasu to provide daily updates of transactions from their users’ bank accounts and credit cards held at local and international banks. Yodlee refused to respond to repeated requests for interviews or to confirm methods of gathering transactional information.

BankLink alleged that Yodlee users could find it difficult to file complaints about fraudulent activity on their accounts because they had inadvertently broken the bank’s terms of use.

Yodlee required users to hand over their account details and passwords so that it could log into online banking sites and “scrape” lists of transactions, said Richard Sheldon, manager of supplier relationships and data at BankLink.

“If you’ve released your password to enable transaction reporting and coincidentally fraud then occurs on the account, the bank (could say that) the terms and conditions are not to release the password. It has been mentioned by some banks that that’s a grey area. You’re just asking a third party to have a look and take the data,” Sheldon said.

Some bank accounts had separate transaction reporting while others recorded the transactions from the same interface used to withdraw money, Sheldon claimed. “That’s why it becomes an issue for fraud. Accountants have told me that it’s one thing a business owner deciding to provide a password to a third party. But as an accountant and the trusted adviser, should you be telling customers to provide their password just to get transaction reporting?” Sheldon said.

The US data aggregator’s methods of collecting data raised other issues, BankLink said. Yodlee’s screen-scraping technique was carried out without the banks’ knowledge and they were not telling Yodlee when they were changing their online banking systems, said Sheldon.

Yodlee users have reported losing transactions from bank feeds that were traced to a bank changing its systems. Sheldon said the fact that users discovered missing transactions before Yodlee did was inevitable. “It’s going to happen when you use a third party with screen-scraping. The first person to know that there’s an issue will be the client,” Sheldon said.

BankLink paid banks and financial institutions in Australia and New Zealand for transactional data and was notified of upcoming changes to systems and formats, he added. “If they make changes to any of their platforms they will inform us and we will make the necessary communications to our clients before there’s a problem.

“We get banks changing systems on us all the time, that’s inevitable. But they work with us to tell us how our data feed is going to look and we make sure we have a continuous feed,” Sheldon said.

BankLink withheld data in the event of a system failure at a bank which could corrupt the data. BankLink then asked the bank to regenerate the account information for BankLink to send on to clients.

Sheldon claimed that accountants using Xero were still relying on BankLink to download transactional information from accounts at Australian and New Zealand banks. “There are plenty of Xero accountants that are still using BankLink as a data provider because of the differences in the service we’ve been talking about,” Sheldon said.

“They receive the data in our BankLink software, code it and then export categorised transactions direct into the Xero ledger. They do the same for MYOB as well,” he said.

About Sholto Macpherson

Sholto Macpherson is an online accounting software analyst, journalist and publisher of Digital First. He is also the author of the Macpherson Report, a vendor-independent report which examines the best technology to run modern accounting firms. He lives and works in Sydney, Australia.